DLL
Subtechnique · ATTACK:enterprise:T1574.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1574.001",
"title": "DLL",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1574/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34",
"external_id": "T1574.001",
"domain": "enterprise",
"created": "2020-03-13T18:11:08.357Z",
"modified": "2026-09-11T19:32:27.370Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"stealth",
"execution"
],
"source_references": [
{
"source_name": "Hijack DLLs CrowdStrike",
"url": "https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/"
},
{
"source_name": "kroll bpl",
"url": "https://www.kroll.com/en/insights/publications/cyber/idatloader-distribution"
},
{
"source_name": "Sophos",
"url": "https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/"
},
{
"source_name": "Hexacorn DLL Hijacking",
"url": "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/"
},
{
"source_name": "microsoft remote preloading",
"url": "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637"
},
{
"source_name": "Microsoft - manifests/assembly",
"url": "https://learn.microsoft.com/en-us/windows/win32/sbscs/manifests?redirectedfrom=MSDN"
},
{
"source_name": "Microsoft redirection",
"url": "https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN"
},
{
"source_name": "dll pre load owasp",
"url": "https://owasp.org/www-community/attacks/Binary_planting"
},
{
"source_name": "Virus Bulletin",
"url": "https://www.virusbulletin.com/conference/vb2023/abstracts/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload/"
},
{
"source_name": "unit 42",
"url": "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/"
},
{
"source_name": "Wietze Beukema DLL Hijacking",
"url": "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows"
}
]
}Explicit source assertions (128)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0390ebec-176f-421a-9823-cce48756aef1
NCC Group Chimera January 2021ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0577a90e-88f7-4b33-8dd2-f5e123f63be2
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 · Microsoft Ransomware as a ServiceATTACK:enterprise:S1041 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05e15ff7-e0b1-47e3-a7bd-7f0e8845bf2c
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0839d954-ce47-4972-bea2-f4d9a76141af
DHS CISA AA22-055A MuddyWater February 2022ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--112b896f-a3df-4b7c-80cd-332d561bc028
Red Canary Dridex Threat Report 2021ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1236d556-1b4a-4d0f-96b2-cf036b30ca17
Sygnia VelvetAnt 2024AATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16d95f0d-fc05-4012-a1a0-35d7261b7f27
Trend Micro Iron Tiger April 2021ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16dfd169-264f-410f-97bf-a1cdec20c50e
Group IB RTM August 2019ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16e906b5-011b-476d-a00d-78e514e7354c
ESET Exchange Mar 2021ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--174698f8-9349-4e52-9887-18089038195c
TrendMicro Patchwork Dec 2017ATTACK:enterprise:S0070 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1762fe5a-0810-4179-bfb0-16d965ffe055
Dell TG-3390 · ZScaler Hacking TeamATTACK:enterprise:S0109 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--191885b6-1282-4173-a2bd-174c30c8a1dc
Mandiant APT1 AppendixATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad315e2-1693-427a-9a04-a613bd0e2f22
FireEye Hikit RootkitATTACK:enterprise:S0176 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bbb499c-81c8-4e94-8305-86b199e8298b
Microsoft SIR Vol 21 · Microsoft Wingbird Nov 2017ATTACK:enterprise:S0528 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cd08976-89bc-4626-987f-a47c9c685f68
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d5e1f26-2a73-4709-bd56-ddfae14f48b9
Kaspersky LODEINFO OCT 2022ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22ce2c93-ecd6-4627-b3f0-6f7476754c79
Microsoft AppLocker DLLATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--283e242a-72d4-4b40-8905-888595c34919
PaloAlto Patchwork Mar 2018 · Forcepoint MonsoonATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29912e12-89f8-4e82-9ebd-2cbb276ed995
ZscalerATTACK:enterprise:S1232 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b1831a6-22e1-4ddb-8b39-00c1ebeeb6de
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:G0107 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e2daf37-1d3d-4b24-ab46-dfc894f9ef96
Symantec Whitefly March 2019ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--325c0731-f5a7-42f5-8f2a-56358613895b
Recorded Future RedDelta 2025ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--328825fa-a589-4c16-abef-7e3663f1f6ec
Microsoft FinFisher March 2018 · FinFisher Citation · Securelist BlackOasis Oct 2017ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38230234-1111-41cf-aa6b-b107577dad61
Crowdstrike HuntReport 2022 · CrowdStrike AQUATIC PANDA December 2021ATTACK:enterprise:S0398 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b4b4665-530f-4b8c-b090-48ae99eae905
Unit42 Emissary Panda May 2019 · Trend Micro Iron Tiger April 2021ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b523bd9-ffc2-4525-a08c-4500bfcb2fed
Cybereason Soft Cell June 2019ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c6a57c5-3854-4198-b6f2-ec4e7766b9bb
CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · ATTACKIQ MUSTANG PANDA TONESHELL March 2023 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Trend Micro Mustang Panda Earth Preta Toneshell February 2025 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Zscaler · Trend Micro Mustang Panda Earth Preta TONESHELL June 2023ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d4524b0-db14-41d1-bcf7-68fce4dca5cc
ESET MirrorFace 2025ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f8a74a9-55fe-4f9c-bddb-00b715ca3668
FireEye APT10 April 2017ATTACK:enterprise:S9029 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--401350a5-c1dd-4448-956e-a31009ef43cd
Check Point Wirte NOV 2024ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40b904c6-d77d-4ba8-98a5-c03d5c2a3186
PTSecurity Higaisa 2020ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44533bc7-0368-4269-b465-7e08d3a8beea
Medium Metamorfo Apr 2020 · ESET Casbaneiro Oct 2019 · FireEye Metamorfo Apr 2018ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44bbd0e1-acdf-458c-934c-a64e8a7a371c
Trend Micro Waterbear December 2019ATTACK:enterprise:S0230 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a4664c1-47dd-4a4a-ab7b-0f64ec137a67
Proofpoint TA459 April 2017 · Proofpoint ZeroT Feb 2017ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ac9f066-58e8-4e8d-bfaa-12520294885c
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S1236 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d6fe46d-b896-4e1e-985c-ce49a7995b74
IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f13e788-b0da-457d-89b1-64196c9627b8
Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · ESET OceanLotus Mar 2019ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54c3c155-6347-4dc5-89df-aae2c15d6c7a
Eset PlugX Korplug Mustang Panda March 2022 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Dell TG-3390 · EclecticIQ Mustang Panda PlugX · Profero APT27 December 2020 · Palo Alto PlugX June 2017 · Trend Micro DRBControl February 2020 · PWC Cloud Hopper Technical Annex April 2017 · Proofpoint TA416 Europe March 2022 · FireEye Clandestine Fox Part 2 · Sophos PlugX September 2022 · Sophos Mustang Panda PLUGX · Stewart 2014ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55e67f6b-600a-4196-b497-63019731e66e
Eset Ramsay May 2020ATTACK:enterprise:S9060 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--570bed8d-56fc-4d63-bad3-87dc08ac9cb1
Mandiant_UNC1549_Feb2024ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a63e7cf-1914-4f05-ac85-5aa1690ed3ef
rapid7-email-bombingATTACK:enterprise:S0074 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c34be50-c7be-40c2-80bb-f3bc7db5cdd7
Dell SakulaATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fd27d34-7250-4c1d-81ce-683cdb527b9c
Cybereason LumaStealer UndatedATTACK:enterprise:S9061 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65d7883b-03ff-41bf-82e1-4dada6255751
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--677f32ad-2aa1-4fe3-8dab-73494891aa4a
Palo Alto T9000 Feb 2016ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67f7ebd0-effb-4169-a184-7d45c614a6ee
ESET EvilNum July 2020ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6874b50a-10e8-4036-bb2d-aabab35ec75b
Arbor Musical Chairs Feb 2018ATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b19a5ae-3f6a-4950-94da-22d94477d5d2
Palo Alto Networks BBSRATATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c4292e7-a284-4524-8efc-1d8e205f6eed
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Palo Alto Networks, Unit 42 · PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cbe59bb-e66e-456e-b230-5880ae6fd5ac
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cd345e0-3571-4596-a817-dace4dd7080b
Check Point Wirte NOV 2024ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ce3735c-bfae-4eec-ab6b-bbf08cb7d60f
ESET Operation GroundbaitATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70b2e51a-c5c4-48af-8f9c-112a4854e18d
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S9059 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71c6ee18-1261-434e-aa95-e3eaad64c3e9
Mandiant_UNC1549_Feb2024ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73ee6e9e-560a-42d1-8578-d5e59899dcf7
Deep Instinct Black Basta August 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74b6a6bc-5cd9-4699-aaff-a8984552e18b
HP RaspberryRobin 2024ATTACK:enterprise:S1235 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76dcc038-7eee-4ab1-a776-af7ee7015d6b
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77dbc1ae-556e-43cd-b776-c7670ab5c915
CitizenLab KeyBoy Nov 2016 · Anomali Pirate Panda April 2020ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7807639f-cc9f-4b0a-9f01-8161cbb1fd53
TrendMicro EarthLusca 2022ATTACK:enterprise:S0585 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79460858-f878-417f-bc10-b4c962128df4
Unit 42 KerrDown February 2019ATTACK:enterprise:S9065 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d08dd0e-97fd-4395-90cd-14070e68a247
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f8b1475-9e41-41d7-84f5-6c4041c4071a
Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80d10b7f-e1eb-4ad0-821c-b35d177418f4
Broadcom · Unit42 Bookworm Nov2015 · Palo Alto Networks, Unit 42ATTACK:enterprise:S9027 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--819fa85e-041c-48a8-9d0c-2db2cd07047b
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:S0530 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--838b2a37-10a1-42fe-bf71-f298ce28f81f
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--861da25e-ea48-469d-8171-d63ad8194208
Mandiant 3cx UNC4736 2023 · Unit42 3cx supply chain 2023ATTACK:enterprise:S1101 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86ecb96d-516e-43eb-b22d-d7c5a9dc14d8
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--881b3ad2-38dd-45b0-b75b-49acf6f7c6a3
Trend Micro Tick November 2019ATTACK:enterprise:S0280 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--883762ff-5cb3-49af-87a2-6a128a1ce939
APT15 Intezer June 2018ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8aab4a0e-fc42-4e5b-aed7-9288e5f456c3
Check Point Wirte NOV 2024ATTACK:enterprise:M1044 → mitigates → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92764952-45ad-4cfc-a426-c6baefc9974c
Microsoft More information about DLL · Microsoft Dynamic Link Library Search OrderATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94ec8332-4115-4c83-900e-a72598a8680b
DCSO StrelaStealer 2022ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99c0cda4-91b1-4845-9891-9a4b89c128f9
FireEye Clandestine Fox · FireEye Clandestine Fox Part 2ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bdcaf47-0df8-44a5-ac10-3f0a806a36f3
GitHub PowerSploit May 2012 · PowerSploit DocumentationATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d2dfa0b-8370-4873-9b8f-4366e61be715
Trend Micro Waterbear December 2019ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d7577f9-2003-4cbc-b7cb-58f2dc20714c
MSTIC FoggyWeb September 2021ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9eaf89d5-01aa-4758-a2a9-abac83d2a17e
Cyble Egregor Oct 2020ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9830f35-1ffa-46a3-b061-07148dd09753
Sygnia Elephant Beetle Jan 2022ATTACK:enterprise:S9067 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa22a791-85e9-40f7-9b92-31846ac0b483
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac77f5ac-4a6e-4c58-a596-5e9aa6f00ff7
Eset PlugX Korplug Mustang Panda March 2022 · Anomali MUSTANG PANDA October 2019 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Broadcom · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · EclecticIQ Mustang Panda PlugX · IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Recorded Future REDDELTA July 2020 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Trend Micro Mustang Panda Earth Preta Toneshell February 2025 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Proofpoint TA416 November 2020 · Unit42 Bookworm Nov2015 · Sophos PlugX September 2022 · Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025 · Zscaler